Overview · mqttjs/MQTT.js · GitHub

Repository navigation

Security

No security policy detected

This project has not set up a SECURITY.md file yet.

Report a vulnerability

MQTT.js: CONNACK properties pollute the user-supplied options object - maximumPacketSize=1 permanently kills the client and escapes to new instances built from the same options, surviving the narrow #1301 fix (verified on 5.15.2)
GHSA-gfxc-3w7m-8ch4 published Sep 16, 2026 by robertsLando

High
MQTT.js: duplicate CONNACK re-enters non-idempotent _onConnect — resends in-flight QoS1 with same ids, resubscribes all topics, resets message-id state mid-session (CWE-664)
GHSA-8phv-jwjm-93rr published Sep 16, 2026 by robertsLando

Moderate
MQTT.js: unsolicited AUTH (rc=24) with default handleAuth passes undefined to _sendPacket — uncaught TypeError kills the whole embedding process (CWE-754)
GHSA-fwrw-4mhv-wxvm published Sep 16, 2026 by robertsLando

High
MQTT.js: SUBACK granted array not bounds-checked against sent subscriptions -> uncaught TypeError -> client process crash (client.ts:1273)
GHSA-rj8f-4655-cgg2 published Sep 16, 2026 by robertsLando

High
MQTT.js ignores MQTT 5 receiveMaximum for inbound QoS 2 packets, allowing broker-driven in-flight store growth
GHSA-h8jm-hm87-fqw3 published Sep 16, 2026 by robertsLando

Low
MQTT.js MQTT 5 unsolicited topic alias crashes client publish handler
GHSA-c8jq-r765-cq7g published Sep 16, 2026 by robertsLando

High

Learn more about advisories related to mqttjs/MQTT.js in the GitHub Advisory Database